b3dee0eff15a9dcb8bf7fdfa9bc4308ec4cc79ba6192f8aaf0e9557994e95c27

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe
Size

380KB
MD5

119af54a298c6cdeac421cf629f682cc
SHA1

3f74267982001d38f5966f291c81f127ed6c8fb1
SHA256

b3dee0eff15a9dcb8bf7fdfa9bc4308ec4cc79ba6192f8aaf0e9557994e95c27
SHA512

3f3519f9bacc01c3b253b1bc023fa76ae3707d22c61d1d8d74b488f2c5989ec45d3f71426c4453da936745161eaaa3415876a169951c9d1238cb14ecf05cae55
SSDEEP

3072:mEGh0o6lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGsl7Oe2MUVg3v2IneKcAEcARy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 11 IoCs

resource	yara_rule
behavioral1/files/0x00070000000122be-4.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000a000000016813-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0030000000016ce4-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002e000000016cf5-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0004000000004ed7-33.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0031000000016ce4-40.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x002f000000016cf5-47.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0014000000016cfd-54.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0007000000016d16-61.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0015000000016cfd-68.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000016d16-75.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{17D465B1-6DEA-4bca-98D8-CBEBD0354654}\stubpath = "C:\\Windows\\{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe"	{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}	{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{710721EA-DC25-4d6c-8269-3A5A728C628B}\stubpath = "C:\\Windows\\{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe"	{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FC87DDCC-2B02-4fe2-A22E-AB629178721A}	{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2A9BB443-EFB9-415a-BA9C-D7FD166453F6}\stubpath = "C:\\Windows\\{2A9BB443-EFB9-415a-BA9C-D7FD166453F6}.exe"	{FC87DDCC-2B02-4fe2-A22E-AB629178721A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{17D4132B-923F-4f7c-8799-DC8B01E2550B}\stubpath = "C:\\Windows\\{17D4132B-923F-4f7c-8799-DC8B01E2550B}.exe"	{2A9BB443-EFB9-415a-BA9C-D7FD166453F6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0748883-3944-4eb2-B0E1-8F55CCF0330F}	{17D4132B-923F-4f7c-8799-DC8B01E2550B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2A33424F-B8B4-40e7-8203-1D729B1401CA}	2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2A33424F-B8B4-40e7-8203-1D729B1401CA}\stubpath = "C:\\Windows\\{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe"	2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{17D465B1-6DEA-4bca-98D8-CBEBD0354654}	{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{17D4132B-923F-4f7c-8799-DC8B01E2550B}	{2A9BB443-EFB9-415a-BA9C-D7FD166453F6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2A9BB443-EFB9-415a-BA9C-D7FD166453F6}	{FC87DDCC-2B02-4fe2-A22E-AB629178721A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}	{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}\stubpath = "C:\\Windows\\{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe"	{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CD88E071-621F-4a08-A091-CA2F1BD39158}	{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CD88E071-621F-4a08-A091-CA2F1BD39158}\stubpath = "C:\\Windows\\{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe"	{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1430C447-3282-4ec5-9467-D1BB98C17E6B}	{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1430C447-3282-4ec5-9467-D1BB98C17E6B}\stubpath = "C:\\Windows\\{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe"	{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FC87DDCC-2B02-4fe2-A22E-AB629178721A}\stubpath = "C:\\Windows\\{FC87DDCC-2B02-4fe2-A22E-AB629178721A}.exe"	{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}\stubpath = "C:\\Windows\\{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe"	{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{710721EA-DC25-4d6c-8269-3A5A728C628B}	{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D0748883-3944-4eb2-B0E1-8F55CCF0330F}\stubpath = "C:\\Windows\\{D0748883-3944-4eb2-B0E1-8F55CCF0330F}.exe"	{17D4132B-923F-4f7c-8799-DC8B01E2550B}.exe

Deletes itself 1 IoCs

pid	Process
2548	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2948	{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe
2524	{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe
2284	{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe
2492	{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe
1540	{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe
2204	{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe
2780	{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe
2028	{FC87DDCC-2B02-4fe2-A22E-AB629178721A}.exe
2072	{2A9BB443-EFB9-415a-BA9C-D7FD166453F6}.exe
688	{17D4132B-923F-4f7c-8799-DC8B01E2550B}.exe
568	{D0748883-3944-4eb2-B0E1-8F55CCF0330F}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe	{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe
File created	C:\Windows\{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe	{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe
File created	C:\Windows\{FC87DDCC-2B02-4fe2-A22E-AB629178721A}.exe	{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe
File created	C:\Windows\{2A9BB443-EFB9-415a-BA9C-D7FD166453F6}.exe	{FC87DDCC-2B02-4fe2-A22E-AB629178721A}.exe
File created	C:\Windows\{D0748883-3944-4eb2-B0E1-8F55CCF0330F}.exe	{17D4132B-923F-4f7c-8799-DC8B01E2550B}.exe
File created	C:\Windows\{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe	2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe
File created	C:\Windows\{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe	{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe
File created	C:\Windows\{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe	{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe
File created	C:\Windows\{17D4132B-923F-4f7c-8799-DC8B01E2550B}.exe	{2A9BB443-EFB9-415a-BA9C-D7FD166453F6}.exe
File created	C:\Windows\{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe	{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe
File created	C:\Windows\{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe	{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2908	2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe
Token: SeIncBasePriorityPrivilege	2948	{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe
Token: SeIncBasePriorityPrivilege	2524	{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe
Token: SeIncBasePriorityPrivilege	2284	{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe
Token: SeIncBasePriorityPrivilege	2492	{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe
Token: SeIncBasePriorityPrivilege	1540	{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe
Token: SeIncBasePriorityPrivilege	2204	{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe
Token: SeIncBasePriorityPrivilege	2780	{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe
Token: SeIncBasePriorityPrivilege	2028	{FC87DDCC-2B02-4fe2-A22E-AB629178721A}.exe
Token: SeIncBasePriorityPrivilege	2072	{2A9BB443-EFB9-415a-BA9C-D7FD166453F6}.exe
Token: SeIncBasePriorityPrivilege	688	{17D4132B-923F-4f7c-8799-DC8B01E2550B}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2948	2908	2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe	28
PID 2908 wrote to memory of 2948	2908	2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe	28
PID 2908 wrote to memory of 2948	2908	2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe	28
PID 2908 wrote to memory of 2948	2908	2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe	28
PID 2908 wrote to memory of 2548	2908	2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe	29
PID 2908 wrote to memory of 2548	2908	2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe	29
PID 2908 wrote to memory of 2548	2908	2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe	29
PID 2908 wrote to memory of 2548	2908	2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe	29
PID 2948 wrote to memory of 2524	2948	{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe	30
PID 2948 wrote to memory of 2524	2948	{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe	30
PID 2948 wrote to memory of 2524	2948	{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe	30
PID 2948 wrote to memory of 2524	2948	{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe	30
PID 2948 wrote to memory of 2796	2948	{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe	31
PID 2948 wrote to memory of 2796	2948	{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe	31
PID 2948 wrote to memory of 2796	2948	{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe	31
PID 2948 wrote to memory of 2796	2948	{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe	31
PID 2524 wrote to memory of 2284	2524	{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe	32
PID 2524 wrote to memory of 2284	2524	{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe	32
PID 2524 wrote to memory of 2284	2524	{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe	32
PID 2524 wrote to memory of 2284	2524	{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe	32
PID 2524 wrote to memory of 2188	2524	{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe	33
PID 2524 wrote to memory of 2188	2524	{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe	33
PID 2524 wrote to memory of 2188	2524	{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe	33
PID 2524 wrote to memory of 2188	2524	{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe	33
PID 2284 wrote to memory of 2492	2284	{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe	36
PID 2284 wrote to memory of 2492	2284	{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe	36
PID 2284 wrote to memory of 2492	2284	{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe	36
PID 2284 wrote to memory of 2492	2284	{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe	36
PID 2284 wrote to memory of 2696	2284	{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe	37
PID 2284 wrote to memory of 2696	2284	{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe	37
PID 2284 wrote to memory of 2696	2284	{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe	37
PID 2284 wrote to memory of 2696	2284	{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe	37
PID 2492 wrote to memory of 1540	2492	{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe	38
PID 2492 wrote to memory of 1540	2492	{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe	38
PID 2492 wrote to memory of 1540	2492	{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe	38
PID 2492 wrote to memory of 1540	2492	{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe	38
PID 2492 wrote to memory of 1240	2492	{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe	39
PID 2492 wrote to memory of 1240	2492	{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe	39
PID 2492 wrote to memory of 1240	2492	{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe	39
PID 2492 wrote to memory of 1240	2492	{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe	39
PID 1540 wrote to memory of 2204	1540	{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe	40
PID 1540 wrote to memory of 2204	1540	{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe	40
PID 1540 wrote to memory of 2204	1540	{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe	40
PID 1540 wrote to memory of 2204	1540	{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe	40
PID 1540 wrote to memory of 2144	1540	{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe	41
PID 1540 wrote to memory of 2144	1540	{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe	41
PID 1540 wrote to memory of 2144	1540	{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe	41
PID 1540 wrote to memory of 2144	1540	{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe	41
PID 2204 wrote to memory of 2780	2204	{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe	42
PID 2204 wrote to memory of 2780	2204	{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe	42
PID 2204 wrote to memory of 2780	2204	{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe	42
PID 2204 wrote to memory of 2780	2204	{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe	42
PID 2204 wrote to memory of 1368	2204	{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe	43
PID 2204 wrote to memory of 1368	2204	{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe	43
PID 2204 wrote to memory of 1368	2204	{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe	43
PID 2204 wrote to memory of 1368	2204	{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe	43
PID 2780 wrote to memory of 2028	2780	{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe	44
PID 2780 wrote to memory of 2028	2780	{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe	44
PID 2780 wrote to memory of 2028	2780	{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe	44
PID 2780 wrote to memory of 2028	2780	{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe	44
PID 2780 wrote to memory of 1856	2780	{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe	45
PID 2780 wrote to memory of 1856	2780	{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe	45
PID 2780 wrote to memory of 1856	2780	{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe	45
PID 2780 wrote to memory of 1856	2780	{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe	45

C:\Users\Admin\AppData\Local\Temp\2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_119af54a298c6cdeac421cf629f682cc_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe
  C:\Windows\{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe
    C:\Windows\{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe
      C:\Windows\{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2284
    - - C:\Windows\{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe
        
        C:\Windows\{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2492
      - C:\Windows\{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe
        
        C:\Windows\{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe
        
        C:\Windows\{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe
        
        C:\Windows\{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\{FC87DDCC-2B02-4fe2-A22E-AB629178721A}.exe
        
        C:\Windows\{FC87DDCC-2B02-4fe2-A22E-AB629178721A}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
        
        C:\Windows\{2A9BB443-EFB9-415a-BA9C-D7FD166453F6}.exe
        
        C:\Windows\{2A9BB443-EFB9-415a-BA9C-D7FD166453F6}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2072
        
        C:\Windows\{17D4132B-923F-4f7c-8799-DC8B01E2550B}.exe
        
        C:\Windows\{17D4132B-923F-4f7c-8799-DC8B01E2550B}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:688
        
        C:\Windows\{D0748883-3944-4eb2-B0E1-8F55CCF0330F}.exe
        
        C:\Windows\{D0748883-3944-4eb2-B0E1-8F55CCF0330F}.exe
        12⤵
        Executes dropped EXE
        
        PID:568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{17D41~1.EXE > nul
        12⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2A9BB~1.EXE > nul
        11⤵
        
        PID:552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FC87D~1.EXE > nul
        10⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1430C~1.EXE > nul
        9⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{71072~1.EXE > nul
        8⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CD88E~1.EXE > nul
        7⤵
        
        PID:2144
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{96EC5~1.EXE > nul
        6⤵
        
        PID:1240
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{10AA1~1.EXE > nul
        5⤵
        
        PID:2696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{17D46~1.EXE > nul
      4⤵
      PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{2A334~1.EXE > nul
    3⤵
    PID:2796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{10AA1BF5-07A7-4cd0-9DB6-E12C63975141}.exe

Filesize
380KB

MD5
b7ab4ceaba064524d947921fb1f51f73

SHA1
cc0aecbb34b99d2d2d70e7f07fcbbe1a1236861a

SHA256
1e41d4f82742d273b0cbc407e450073a2503dd0c4fc5dc37acaea32f457afa34

SHA512
4f4e5fe96a9d3ba2dd4fa81f177438029d9cf14ee4a024e1f7247f44dd0cc9eff6fc6233d54aaf5822811bdf4657a1cea4d1ee3353b408b7c8c04ffb2105c633

Download Submit
C:\Windows\{1430C447-3282-4ec5-9467-D1BB98C17E6B}.exe

Filesize
380KB

MD5
e2fa33b56566da2be411ffb59eb7f1f6

SHA1
09313c1fb7321dfcba044fd4e5f2d3dea06b7b6c

SHA256
57f1dba19e902c947113d23d417cc955d97e2f16ca0117d8618dc7166c250444

SHA512
bc6ed1d611ecbf7de4dc845a1533b8b071ae8a9230153314d1b745dbd1e4f2562f0ad9cea9bb518763c7c800421b209f087105a1f490e80823691e790cc35ca9

Download Submit
C:\Windows\{17D4132B-923F-4f7c-8799-DC8B01E2550B}.exe

Filesize
380KB

MD5
1bf80b1100f0f87760e680913e260075

SHA1
b106da25c0a16d6ec8bc99a5cc39a809ab634bd3

SHA256
f3ee896d140c021a084f759a60e978889a6663b6eb274d20853cf3330afd8106

SHA512
73693dcd58946550814467ef0ebb28e119c5a81555054ad224e55d66d350ee44d8b06b94c4c41a66668d8f1f06a5cbfc4c5a2b532bc85bd17ec94b90632d00f4

Download Submit
C:\Windows\{17D465B1-6DEA-4bca-98D8-CBEBD0354654}.exe

Filesize
380KB

MD5
178ed4d88e544c4faffea79d92d64ba0

SHA1
02b0a498d947998fbf8bb22c137098a0483fb926

SHA256
b0610b41bede1fc5b56ff76a64dd8d759d4a317495803161cecb08627722fb29

SHA512
1533aa28fd7a78347c026ba3f1e10a7aa0548eac9da9db5c4833621e48533b9d2cb60960cd5ffecff6743b6b49960018eb455c66ad308f0818a7743f2a2967db

Download Submit
C:\Windows\{2A33424F-B8B4-40e7-8203-1D729B1401CA}.exe

Filesize
380KB

MD5
b295c9fc2331b9c3fd0be93acfb257e5

SHA1
abae3a7b20feaf2874114eaa5bb4a30dc376b1a0

SHA256
7c877a8d8ff9dc780ed69ef4b1c4f726b5b5fa1355344e312627746165774e72

SHA512
f1936fca41ba08f6cef998070d94e24bc98082eaa0eaad7c58083b7d415f05546c617622c31217c8c4d8ab635d876c1ec8bb49ba1f4c653ba2b9b6593fbd2d8e

Download Submit
C:\Windows\{2A9BB443-EFB9-415a-BA9C-D7FD166453F6}.exe

Filesize
380KB

MD5
01701b783bc8ae67549e6dd15fef46e1

SHA1
3bc22f9f87194d0ccbe5903d5c8a2ce2ed4cc962

SHA256
575174f472df960f6c664e849d1d30bb87353a982c1e326ce0d2d53be2c1bd40

SHA512
a4713f301f097dcb433fa0c051c71b838fc78da01cd1893735ed9f321541f16ad0cb92971c5d0d25674d766ef88abc9ef7a0d0755122f12afb5e647efbeb50ba

Download Submit
C:\Windows\{710721EA-DC25-4d6c-8269-3A5A728C628B}.exe

Filesize
380KB

MD5
cee8bb3eda8ba65fcd2c540bfb41dbf5

SHA1
1b24fc318270174bcaea9195595b1e8575643a05

SHA256
ecc2140a3b4bd8c8cf018c025d2ccf6deed6d07898a36c4b3d55e82e40927575

SHA512
ed847147600305f20d09af73c70c53d8b46ac04d72d6aa0f171c683f6f6c5afb8efd87f8aef69e8ef797c0117a371b4e4b1e8931ad944b5ec9255de9887a2807

Download Submit
C:\Windows\{96EC5B92-12EB-46ee-96C8-F08F0AC646DB}.exe

Filesize
380KB

MD5
f21de51dcbd7048dc4624d05d6348a21

SHA1
b394090fed10d4b6db866c2d88c9a4c5d8701762

SHA256
402405d8ada72dc825d6c5615514dd7b6b2ec7ff33aa34649eb1fa6b100f6c1c

SHA512
359697d013113feae05f5b2eb7220e277708835406b5e321e57f7ac2cb90a74d585138da761b6d178c5481883611a49fce36c32a1d4074935bd41ed288651789

Download Submit
C:\Windows\{CD88E071-621F-4a08-A091-CA2F1BD39158}.exe

Filesize
380KB

MD5
23e29920a8aa608c29fe66fb4b552aa7

SHA1
cabaaef27aaa150fa14ae6a08a74c5ea46006d1f

SHA256
13e04424d40ddf0474af261bc3ce10c06dc2415cb68c210b0b0a52238fbf86ec

SHA512
388955bc0029e570069338c90dc8e8a5811020fe3777a26e7349a5ad6d899f99beda562debefcb615e69b5971d207419e2545a40f118af58f7e0def3e0897e6e

Download Submit
C:\Windows\{D0748883-3944-4eb2-B0E1-8F55CCF0330F}.exe

Filesize
380KB

MD5
e1ff7945d9a3c4ba3abe6391296d1754

SHA1
1037c05924a23ca5c61d48b79779a082b892f46a

SHA256
9aa35027b811e678a4d82b3e8e63cbf7efe717d1b779cd5817e19cbe65877894

SHA512
ee2c2545ce7135bd902976a8883c312aa96b488b0b08090c0424a1629af28d2eafb377a6aade3f10d882a67c2daac06a8771295730b702b18a740ae718dd717f

Download Submit
C:\Windows\{FC87DDCC-2B02-4fe2-A22E-AB629178721A}.exe

Filesize
380KB

MD5
5912d9df0b961301f91cb702400321de

SHA1
fcb099555c908de70af7744c5b1e36e44500e39f

SHA256
d0ade3dfb6e9203951248098453f017d70f21e3f20af0bbf71ac5eb43a4553ea

SHA512
b4ca7c94c2775cdcecdf215177824280bc022abbd27a862587898adb922d1a7e5b63daba9bc6e234e54f925851f9dc27f63468f98eed139dbc92b8ab1586b9ad

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads